—

GO-2026-6182

Command execution via PowerShell smart quotes in github.com/rclone/rclone

Quick fix

GO-2026-6182 — github.com/rclone/rclone: upgrade to the fixed version with the command below.

go get github.com/rclone/rclone@v1.75.0

Details

PowerShell treats several Unicode smart-quote characters (U+2018, U+2019, U+201A, U+201B) as single-quote delimiters in addition to ASCII apostrophe. When interpolating remote SFTP paths into PowerShell commands, rclone only escapes the ASCII apostrophe, allowing an attacker to craft a filename with smart quotes that closes the path literal and injects arbitrary PowerShell commands executed on the SFTP remote as the victim's SSH account.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go / github.com/rclone/rclone

Introduced in: 0 Fixed in: 1.75.0

Fix go get github.com/rclone/rclone@v1.75.0

References

https://github.com/rclone/rclone/security/advisories/GHSA-2m8m-jhrm-w6j2 [ADVISORY]
https://github.com/rclone/rclone/commit/e122fba1a57641b63a580aa26c026903a84e2e88 [FIX]
https://github.com/rclone/rclone/releases/tag/v1.75.0 [WEB]